The flaw resides in the high‑level diff API of GitPython 3.1.59, where the --no-index switch is not properly constrained. An attacker can invoke GitPython with this option to feed arbitrary file system paths as repository operands. By pairing --no-index with the -I/--ignore-matching-lines flag, the attacker turns the API into a content‑dependent Boolean oracle, repeatedly probing local files and distinguishing success from error responses. This technique can be used to recover single‑line secrets such as passwords, API keys, or other sensitive data found in the filesystem, presenting a clear confidentiality risk.

Vendors: GitPython developers. Product: GitPython 3.1.59. The vulnerability is specific to this release and does not affect earlier or later versions that have applied the patch and removed the unchecked usage of --no-index.

The CVSS score of 7.1 indicates a high‑severity vulnerability. The EPSS score is not reported, and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation at this time. Attackers must be able to run the compromised GitPython code on the target host, meaning the tactical vector is local. The Boolean oracle can be exploited repeatedly to enumerate file contents, leading to potential data exfiltration if secrets reside on the system. Overall, even without remote access, the combination of local execution privileges and the absence of restrictions on --no-index creates a significant risk to confidentiality.